Analysis

  • max time kernel
    126s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-09-2024 01:31

General

  • Target

    497fa678528f8dc7dfaebe76f73061581f621d5eb2ed06e0c8b937a9131e9191.exe

  • Size

    1.8MB

  • MD5

    d91d3dba1e492cdc999cd2f7d8a22c2e

  • SHA1

    d4b46c959754f8f00e136783429455feb434e373

  • SHA256

    497fa678528f8dc7dfaebe76f73061581f621d5eb2ed06e0c8b937a9131e9191

  • SHA512

    44b4fd513551176f7890bc3f6c4009087ada59f22594ab69807ef88e86d1e22aab498da30c160eb8aebdf21b11f2dd9c69ae8259b5da4489bd73e0f373607fdd

  • SSDEEP

    49152:p1PIEUo4HUzX3NZIYAaNtMMSmtS5Mu2AukpycABfB71cx:/hUnsQYAaNtnzS5/2xcAJhY

Malware Config

Extracted

Family

lokibot

C2

http://idp.vn/wp-includes/js/crop/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • Class file contains resources related to AdWind 2 IoCs
  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 33 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 14 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:788
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:792
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:336
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2468
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2488
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2900
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3488
                  • C:\Users\Admin\AppData\Local\Temp\497fa678528f8dc7dfaebe76f73061581f621d5eb2ed06e0c8b937a9131e9191.exe
                    "C:\Users\Admin\AppData\Local\Temp\497fa678528f8dc7dfaebe76f73061581f621d5eb2ed06e0c8b937a9131e9191.exe"
                    2⤵
                    • Checks computer location settings
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3268
                    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Windows\system32\server.jar"
                      3⤵
                        PID:3016
                      • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Windows\system32\server1.jar"
                        3⤵
                          PID:1312
                        • C:\Windows\SysWOW64\build.exe
                          "C:\Windows\system32\build.exe"
                          3⤵
                          • Modifies firewall policy service
                          • UAC bypass
                          • Windows security bypass
                          • Deletes itself
                          • Executes dropped EXE
                          • Windows security modification
                          • Accesses Microsoft Outlook profiles
                          • Checks whether UAC is enabled
                          • Enumerates connected drives
                          • Drops autorun.inf file
                          • Drops file in System32 directory
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          • outlook_office_path
                          • outlook_win_path
                          PID:1068
                          • C:\Windows\SysWOW64\buildmgr.exe
                            C:\Windows\SysWOW64\buildmgr.exe
                            4⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:1780
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 516
                              5⤵
                              • Program crash
                              PID:3560
                        • C:\Users\Admin\AppData\Roaming\svchost.exe
                          "C:\Users\Admin\AppData\Roaming\svchost.exe"
                          3⤵
                          • Modifies firewall policy service
                          • UAC bypass
                          • Windows security bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Windows security modification
                          • Adds Run key to start application
                          • Checks whether UAC is enabled
                          • Enumerates connected drives
                          • Drops file in System32 directory
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:3840
                          • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                            "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Windows\system32\server.jar"
                            4⤵
                              PID:1956
                            • C:\Program Files\Java\jre-1.8\bin\javaw.exe
                              "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Windows\system32\server1.jar"
                              4⤵
                                PID:1764
                              • C:\Windows\SysWOW64\build.exe
                                "C:\Windows\system32\build.exe"
                                4⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:5020
                                • C:\Windows\SysWOW64\buildmgr.exe
                                  C:\Windows\SysWOW64\buildmgr.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:2220
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 452
                                    6⤵
                                    • Program crash
                                    PID:3228
                              • C:\Users\Admin\AppData\Roaming\svchost.exe
                                "C:\Users\Admin\AppData\Roaming\svchost.exe "
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:1144
                                • C:\Users\Admin\AppData\Roaming\svchostmgr.exe
                                  C:\Users\Admin\AppData\Roaming\svchostmgr.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:4948
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                          1⤵
                            PID:3664
                          • C:\Windows\system32\DllHost.exe
                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                            1⤵
                              PID:3852
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:3948
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:4012
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:408
                                  • C:\Windows\System32\RuntimeBroker.exe
                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                    1⤵
                                      PID:3556
                                    • C:\Windows\System32\RuntimeBroker.exe
                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                      1⤵
                                        PID:4292
                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                        1⤵
                                          PID:3708
                                        • C:\Windows\System32\RuntimeBroker.exe
                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                          1⤵
                                            PID:1476
                                          • C:\Windows\System32\RuntimeBroker.exe
                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                            1⤵
                                              PID:640
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1780 -ip 1780
                                              1⤵
                                                PID:2708
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2220 -ip 2220
                                                1⤵
                                                  PID:3868

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Temp\~TME436.tmp

                                                  Filesize

                                                  1.6MB

                                                  MD5

                                                  4f3387277ccbd6d1f21ac5c07fe4ca68

                                                  SHA1

                                                  e16506f662dc92023bf82def1d621497c8ab5890

                                                  SHA256

                                                  767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

                                                  SHA512

                                                  9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-945322488-2060912225-3527527000-1000\0f5007522459c86e95ffcc62f32308f1_03d68389-5a68-4d9e-92ac-47b927e624dd

                                                  Filesize

                                                  46B

                                                  MD5

                                                  d898504a722bff1524134c6ab6a5eaa5

                                                  SHA1

                                                  e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

                                                  SHA256

                                                  878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

                                                  SHA512

                                                  26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-945322488-2060912225-3527527000-1000\0f5007522459c86e95ffcc62f32308f1_03d68389-5a68-4d9e-92ac-47b927e624dd

                                                  Filesize

                                                  46B

                                                  MD5

                                                  c07225d4e7d01d31042965f048728a0a

                                                  SHA1

                                                  69d70b340fd9f44c89adb9a2278df84faa9906b7

                                                  SHA256

                                                  8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

                                                  SHA512

                                                  23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

                                                • C:\Users\Admin\AppData\Roaming\svchost.exe

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  d91d3dba1e492cdc999cd2f7d8a22c2e

                                                  SHA1

                                                  d4b46c959754f8f00e136783429455feb434e373

                                                  SHA256

                                                  497fa678528f8dc7dfaebe76f73061581f621d5eb2ed06e0c8b937a9131e9191

                                                  SHA512

                                                  44b4fd513551176f7890bc3f6c4009087ada59f22594ab69807ef88e86d1e22aab498da30c160eb8aebdf21b11f2dd9c69ae8259b5da4489bd73e0f373607fdd

                                                • C:\Windows\SYSTEM.INI

                                                  Filesize

                                                  257B

                                                  MD5

                                                  85021684293a08001c887fbfe838dc8e

                                                  SHA1

                                                  6dade030306ca73bc810a20bead961d0d2c997e4

                                                  SHA256

                                                  a4e45858346af834395a87beba369aa7aeed93e50d625d3ef3908534126663b0

                                                  SHA512

                                                  8be885926f93f5ec4d937bf0da6a99643f8b1bcb36af10afbf2314b5350db08c5194ec740012312cde939beee792fae662c6e9af01903827269419b213e4af0f

                                                • C:\Windows\SysWOW64\build.exe

                                                  Filesize

                                                  284KB

                                                  MD5

                                                  893388d890e5d46cb68616529088b6e3

                                                  SHA1

                                                  6a8bfe9901157ae9e1a589c868f15ea1f7c060ac

                                                  SHA256

                                                  bb7182eb5c655dc0a27d495b63c34805c23065234cec48d672fd86272c9df6c8

                                                  SHA512

                                                  e38c2163d9ef295d201566dfd4a4b31d93ca263c203ca2d75ad91aebdf0945253112198aae50b9b433470b11e60aa5c20428472472e641c1350bed474de6c24d

                                                • C:\Windows\SysWOW64\buildmgr.exe

                                                  Filesize

                                                  106KB

                                                  MD5

                                                  fe36fb1073e6f8fa14d7250501a29aaf

                                                  SHA1

                                                  6c7e01278362797dabcff3e666b68227cb9af10f

                                                  SHA256

                                                  f34e5af97ccb3574f7d5343246138daf979bfd1f9c37590e9a41f6420ddb3bb6

                                                  SHA512

                                                  8584c008c5780352f634c37b7f46543a26280b57577b675f6e72185bfc1d95f771d210d799d704eceaba509ebfd2796fb43829495d5b2a568c741ad2d44f882f

                                                • C:\Windows\SysWOW64\server.jar

                                                  Filesize

                                                  473KB

                                                  MD5

                                                  e5cd3dde85d18f58adf2baaa660c6728

                                                  SHA1

                                                  656ecf0740dcf0792f58c0d2948b1d721efdcd99

                                                  SHA256

                                                  ec8522c41c9bbd8e7625a62c0ae9c98cbe130d396a65ba70316e98deb988fbcb

                                                  SHA512

                                                  d83fa91d3f8595fd6ed467a43f8d1a373942f39c144000e735babb8f7cc6c9972b8944cce56fa04e48f9cb0c60562be3dd79ec14a52aad840a3c7123f606bb6e

                                                • C:\Windows\SysWOW64\server1.jar

                                                  Filesize

                                                  473KB

                                                  MD5

                                                  5fb36a3af54997d4b665deda56c06894

                                                  SHA1

                                                  80f8db18da9ec369acba09449c48a6daba2fbf96

                                                  SHA256

                                                  fb270bd422f667d3e4317132a2ae2805bde6e7154be681a12648b2ddd824639f

                                                  SHA512

                                                  cae2f1db1aa5f83d9971ba9aadd32f1cdf33f9b79e6f480b3727cf3dfe3956f670b46559c554c1529a627f557a951edcbb2b4a6bca5b2d40c9021d12f4b7e38a

                                                • C:\rnaeer.pif

                                                  Filesize

                                                  100KB

                                                  MD5

                                                  52dcd22f38ee52af8c6e9ab384ddd803

                                                  SHA1

                                                  98a2eeec87bde48d44c85768449fa7917163df72

                                                  SHA256

                                                  c36445bb0f576ac1788aebc729f69970d83cebdfb5a7980d04febd4370d0793d

                                                  SHA512

                                                  a0308b530bad5c3b5b294c3821f167f822ee7ab141c762ff5571fa38d1c3a8ef070f74353ce81fc02b2bb5c1686504fc41d08784b71aff637703510559870a9a

                                                • memory/1068-97-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-73-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-40-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-41-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-195-0x0000000000400000-0x00000000004D0000-memory.dmp

                                                  Filesize

                                                  832KB

                                                • memory/1068-178-0x0000000000400000-0x00000000004D0000-memory.dmp

                                                  Filesize

                                                  832KB

                                                • memory/1068-131-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-28-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-130-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-128-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-99-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-54-0x0000000004170000-0x0000000004172000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1068-46-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-47-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-49-0x00000000042C0000-0x00000000042C1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/1068-45-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-44-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-43-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-48-0x0000000004170000-0x0000000004172000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1068-98-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-63-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-64-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-68-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-69-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-70-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-72-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-16-0x0000000000400000-0x00000000004D0000-memory.dmp

                                                  Filesize

                                                  832KB

                                                • memory/1068-38-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-78-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-79-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-80-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-82-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-84-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-88-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-87-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-92-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-94-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1068-96-0x0000000002230000-0x00000000032BE000-memory.dmp

                                                  Filesize

                                                  16.6MB

                                                • memory/1144-110-0x0000000000400000-0x00000000004D0000-memory.dmp

                                                  Filesize

                                                  832KB

                                                • memory/1144-121-0x0000000000400000-0x00000000004D0000-memory.dmp

                                                  Filesize

                                                  832KB

                                                • memory/1144-119-0x0000000000400000-0x00000000004D0000-memory.dmp

                                                  Filesize

                                                  832KB

                                                • memory/1780-59-0x00000000006A0000-0x00000000006A2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1780-55-0x00000000006A0000-0x00000000006A2000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1780-62-0x0000000000400000-0x000000000042A000-memory.dmp

                                                  Filesize

                                                  168KB

                                                • memory/1780-51-0x0000000000730000-0x0000000000731000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/3268-2-0x0000000074900000-0x0000000074EB1000-memory.dmp

                                                  Filesize

                                                  5.7MB

                                                • memory/3268-42-0x0000000074900000-0x0000000074EB1000-memory.dmp

                                                  Filesize

                                                  5.7MB

                                                • memory/3268-1-0x0000000074900000-0x0000000074EB1000-memory.dmp

                                                  Filesize

                                                  5.7MB

                                                • memory/3268-0-0x0000000074902000-0x0000000074903000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/3268-7-0x0000000074900000-0x0000000074EB1000-memory.dmp

                                                  Filesize

                                                  5.7MB

                                                • memory/3268-6-0x0000000074902000-0x0000000074903000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/3840-56-0x0000000005B70000-0x0000000005B72000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/3840-53-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/5020-103-0x0000000000400000-0x00000000004D0000-memory.dmp

                                                  Filesize

                                                  832KB

                                                • memory/5020-116-0x0000000000400000-0x00000000004D0000-memory.dmp

                                                  Filesize

                                                  832KB